From 94fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62f Mon Sep 17 00:00:00 2001
From: Luis Hector Chavez <lhchavez@google.com>
Date: Thu, 16 Nov 2017 15:52:00 -0800
Subject: [PATCH] init: Drop inheritable capabilities when switching uids

This change explicitly drops all inheritable capabilities (and, by
extension, ambient capabilities) when there are no explicit capabilities
being set by a service and the user is changed. This prevents Android
running in a container from accidentally granting extra capabilities to
services.

Bug: 69320306
Test: aosp_sailfish still boots
Test: sailfish:/ $ grep Cap /proc/`pidof android.hardware.audio@2.0-service`/status
      CapInh: 0000000000000000
      CapPrm: 0000000000000000
      CapEff: 0000000000000000
      CapBnd: 0000003fffffffff
      CapAmb: 0000000000000000
Test: sailfish:/ $ grep Cap /proc/`pidof logd`/status
      CapInh: 0000000000000000
      CapPrm: 0000000440000000
      CapEff: 0000000440000000
      CapBnd: 0000003fffffffff
      CapAmb: 0000000000000000
Test: Android in Chrome OS still boots
Test: localhost ~ # grep Cap /proc/`pidof android.hardware.audio@2.0-service`/status
      CapInh: 0000000000000000
      CapPrm: 0000000000000000
      CapEff: 0000000000000000
      CapBnd: 000000006daefdff
      CapAmb: 0000000000000000
Test: localhost ~ # grep Cap /proc/`pidof logd`/status
      CapInh: 0000000000000000
      CapPrm: 0000000040000000
      CapEff: 0000000040000000
      CapBnd: 000000006daefdff
      CapAmb: 0000000000000000

Change-Id: I9218f2e27ff4fb4d91d50f9a98c0fdb4e272952c
---
 init/capabilities.cpp | 13 +++++++++++++
 init/capabilities.h   |  1 +
 init/service.cpp      |  5 +++++
 3 files changed, 19 insertions(+)

diff --git a/init/capabilities.cpp b/init/capabilities.cpp
index 642a3642f..50987db7c 100644
--- a/init/capabilities.cpp
+++ b/init/capabilities.cpp
@@ -194,5 +194,18 @@ bool SetCapsForExec(const CapSet& to_keep) {
     return SetAmbientCaps(to_keep);
 }
 
+bool DropInheritableCaps() {
+    ScopedCaps caps(cap_get_proc());
+    if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
+        PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed";
+        return false;
+    }
+    if (cap_set_proc(caps.get()) != 0) {
+        PLOG(ERROR) << "cap_set_proc() failed";
+        return false;
+    }
+    return true;
+}
+
 }  // namespace init
 }  // namespace android
diff --git a/init/capabilities.h b/init/capabilities.h
index ede85c324..fc80c9864 100644
--- a/init/capabilities.h
+++ b/init/capabilities.h
@@ -35,6 +35,7 @@ int LookupCap(const std::string& cap_name);
 bool CapAmbientSupported();
 unsigned int GetLastValidCap();
 bool SetCapsForExec(const CapSet& to_keep);
+bool DropInheritableCaps();
 
 }  // namespace init
 }  // namespace android
diff --git a/init/service.cpp b/init/service.cpp
index 481df659c..331b859b7 100644
--- a/init/service.cpp
+++ b/init/service.cpp
@@ -291,6 +291,11 @@ void Service::SetProcessAttributes() {
         if (!SetCapsForExec(capabilities_)) {
             LOG(FATAL) << "cannot set capabilities for " << name_;
         }
+    } else if (uid_) {
+        // Inheritable caps can be non-zero when running in a container.
+        if (!DropInheritableCaps()) {
+            LOG(FATAL) << "cannot drop inheritable caps for " << name_;
+        }
     }
 }